@kitsy/cnos-docs 1.11.0 → 1.11.2

package/docs/api/runtime.mdx

@@ -119,7 +119,7 @@ Vault selection is declared in `.cnos/cnos.yml`; runtime code only declares whic
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp-secret-manager';
+import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp';
 
 cnos.registerSecretVaultProvider(createGcpSecretManagerVaultProvider());
 await cnos.ready();

package/docs/cli/secret.mdx

@@ -9,10 +9,13 @@ description: Set, get, list, and delete secrets through configured vaults.
 cnos secret set app.token super-secret --vault default
 cnos secret set app.token --vault default
 printf "super-secret" | cnos secret set app.token --vault default --stdin
+cnos secret set app.token --vault prod-gcp
 cnos secret get app.token --vault default --reveal
 cnos secret list
 cnos secret list --reveal
 cnos secret delete app.token
 ```
 
-If you omit `[value]`, CNOS prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use `--stdin`.
+For local vaults, omitting `[value]` prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use `--stdin`.
+
+For non-local vaults such as `environment`, `gcp-secret-manager`, `aws-secrets-manager`, `hashicorp-vault`, and `azure-key-vault`, `cnos secret set` writes repo-safe reference metadata only. If `[value]` is omitted, CNOS uses the logical path as the external ref and does not prompt for secret material. Create or update the actual secret in the backing vault separately.

package/docs/cli/vault.mdx

@@ -18,3 +18,5 @@ For local vaults, `cnos vault create <name>` initializes the encrypted keystore
 `cnos vault auth <name>` re-authenticates an existing vault and fails on wrong credentials. Successful auth writes a derived session key under `~/.cnos/secrets/sessions`, so later CNOS commands can reuse it across shells until you run `cnos vault logout <name>` or `cnos vault logout --all`. With `--store-keychain`, CNOS also stores the derived key in the OS keychain.
 
 After local vault auth, `cnos secret set <path> --vault <name>` can prompt for a masked secret value interactively when you omit `[value]`.
+
+`cnos vault list` can also run outside a CNOS project. In that mode it lists local vault stores from the configured CNOS secret home instead of requiring `.cnosrc.yml`. Project-scoped vault definitions are included when the command runs inside a CNOS workspace.

package/docs/guides/secrets.mdx

@@ -15,7 +15,7 @@ cnos secret set app.token --vault default
 
 `cnos vault create default` initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. `cnos vault auth default` is only for re-authenticating an existing vault and rejects wrong passphrases.
 
-When `[value]` is omitted, `cnos secret set` prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use `--stdin` instead:
+For local vaults, when `[value]` is omitted, `cnos secret set` prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use `--stdin` instead:
 
 ```bash
 printf "super-secret" | cnos secret set app.token --vault default --stdin
@@ -26,10 +26,13 @@ Environment-backed vault:
 ```bash
 cnos vault create firebase-prod --provider environment --no-passphrase
 cnos secret set app.token APP_TOKEN --vault github-ci
+cnos secret set app.token --vault firebase-prod
 ```
 
 `environment` is the generic provider for platforms that inject secrets into environment variables before your process starts. `github-secrets` remains a compatibility alias for the same behavior.
 
+For non-local vaults such as `environment`, `gcp-secret-manager`, `aws-secrets-manager`, `hashicorp-vault`, and `azure-key-vault`, `cnos secret set` writes reference metadata only. CNOS does not prompt for or store secret material in the repo. If `[value]` is omitted, CNOS uses the logical secret path as the external ref; create or update the actual secret in the backing vault separately.
+
 This is the CNOS bridge for common cloud and CI runtimes:
 
 - GitHub Actions secrets

package/docs/guides/vault-providers.mdx

@@ -11,17 +11,17 @@ Remote vault providers are compiled into the application runtime. CNOS never loa
 
 Official providers use this package shape:
 
-- `@kitsy/cnos-vault-gcp-secret-manager`
-- `@kitsy/cnos-vault-aws-secrets-manager`
+- `@kitsy/cnos-vault-gcp`
+- `@kitsy/cnos-vault-aws`
 - `@kitsy/cnos-vault-hashicorp`
-- `@kitsy/cnos-vault-azure-key-vault`
-- `@kitsy/cnos-vault-firebase-secrets`
+- `@kitsy/cnos-vault-azure`
+- `@kitsy/cnos-vault-firebase`
 
 Each package must export a factory named `create<Vendor>VaultProvider()`. The factory returns a `SecretVaultProviderFactory` whose `provider` field exactly matches the manifest provider name.
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp-secret-manager';
+import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp';
 
 cnos.registerSecretVaultProvider(createGcpSecretManagerVaultProvider());
 await cnos.ready();
@@ -115,7 +115,7 @@ Install and register the compiled-in provider:
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp-secret-manager';
+import { createGcpSecretManagerVaultProvider } from '@kitsy/cnos-vault-gcp';
 
 cnos.registerSecretVaultProvider(createGcpSecretManagerVaultProvider());
 await cnos.ready();
@@ -143,7 +143,7 @@ Install and register the compiled-in provider:
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createFirebaseSecretsVaultProvider } from '@kitsy/cnos-vault-firebase-secrets';
+import { createFirebaseSecretsVaultProvider } from '@kitsy/cnos-vault-firebase';
 
 cnos.registerSecretVaultProvider(createFirebaseSecretsVaultProvider());
 await cnos.ready();
@@ -177,7 +177,7 @@ Install and register the compiled-in provider:
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createAwsSecretsManagerVaultProvider } from '@kitsy/cnos-vault-aws-secrets-manager';
+import { createAwsSecretsManagerVaultProvider } from '@kitsy/cnos-vault-aws';
 
 cnos.registerSecretVaultProvider(createAwsSecretsManagerVaultProvider());
 await cnos.ready();
@@ -239,7 +239,7 @@ Install and register the compiled-in provider:
 
 ```ts
 import cnos from '@kitsy/cnos';
-import { createAzureKeyVaultProvider } from '@kitsy/cnos-vault-azure-key-vault';
+import { createAzureKeyVaultProvider } from '@kitsy/cnos-vault-azure';
 
 cnos.registerSecretVaultProvider(createAzureKeyVaultProvider());
 await cnos.ready();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-docs",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Source-of-truth CNOS documentation content for Astro Starlight and other static docs consumers.",
   "type": "module",
   "exports": {